Zephyr WireGuard CVE-2026-79977

Requires CONFIG_WIREGUARD to be built and enabled - it is marked experimental and is NOT enabled by default, which is the primary limiting factor. The vulnerable branch runs only when the targeted peer has neither a valid handshake nor a current keypair, i.e. the normal state at boot and after a session expires (~180 s idle); an active session must not be in progress. The attacker only needs the ability to send a UDP datagram to the listener, which is registered via net_udp_register() with no remote address or port filter on the predictable default port 51820 (CONFIG_WIREGUARD_PORT), so no on-path position, no observed traffic and no credentials are needed. Persistent, unrecoverable denial applies specifically to devices whose configured peer does not itself initiate handshakes; a peer that initiates can re-establish, and the attacker must resend the trigger periodically to maintain poisoning.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) accurately captures the mechanism: a single unauthenticated UDP datagram sent off-path to the default WireGuard port triggers the defect with no privileges, no user interaction and low complexity, yielding high availability impact (persistent tunnel denial) plus low confidentiality impact (traffic-metadata observation and selective dropping if the attacker relays initiations to MITM). Integrity is correctly N because WireGuard's end-to-end AEAD still prevents decryption or forgery of tunnel content - this is endpoint poisoning, not key compromise. No EPSS score is present in the input, so statistical exploitation probability cannot be weighed; the vulnerability is NOT in CISA KEV (status: not listed) and there is no indication of active exploitation. A detailed proof-of-concept - the exact 16-byte packet layout - is published in the GHSA advisory/original report, so working off-path exploitation is trivial in principle. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits the picture: trivially exploitable but bounded in reach. The key risk-limiting factor, which the raw 8.2 does not express, is that CONFIG_WIREGUARD is experimental and not enabled by default, so the real-world attack surface is confined to devices that have deliberately built and enabled this subsystem. This is therefore a genuine, easy-to-exploit availability/MITM flaw on affected configurations, but exposure is gated by an opt-in experimental feature rather than being widespread.

An off-path attacker who can route a UDP packet to a Zephyr device's WireGuard port (default 51820) sends a single 16-byte transport-data datagram (type 0x04, zeroed reserved bytes, an arbitrary receiver index) while the peer is in its post-boot or post-expiry state with no valid handshake or keypair. The device copies the spoofed source address into peer->endpoint and immediately directs all handshake initiations, keepalives and encrypted data to the attacker, leaving the tunnel permanently down or letting the attacker relay initiations to the real peer and sit in-path. A full PoC packet specification is published in the advisory, so the attack requires no observation of legitimate traffic and no cryptographic material.